D. S. – €3,500 Fine (Poland, 2020)

Mr. D. S., a German citizen, submitted a complaint against the processing of his personal data by the company East Power Sp. z o.o. with a registered address in Jelenia Góra, Poland. The complainant submitted that his personal data was used for marketing purposes despite that he objected to such processing. The complaint was lodged with the German data protection authority competent for Rhineland-Palatinate, but it was taken over for consideration by the President of the UODO, who was the so-called lead authority in this case, because the company is established in Poland. The UODO has contacted the company and asked to answer the following questions: 1. On what legal basis, for what purpose and to what extent the company is currently processing the complainant's personal data and from what source the data was obtained. 2. Whether the complainant has requested that the company delete his personal data. 3. In case the complainant requested the deletion of his personal data, why and on what legal basis was his request not complied with. The company did not reply to the set of questions; the UODO has repeated its request. The company responded that it had not processed the complainant's personal data neither before nor at the time of the request made by the UODO. The company also informed that it had not disclosed the complainant's personal data. At the same time, the President of the company's Management Board stated that "the Company obtained the Complainant's personal data from the Internet", where "they are available in the Google search engine". The company addressed only one of the two requests, and the explanations provided were incomplete and contradictory. The UODO has therefore sent another request to clarify the answer provided. The company did not respond to the third request of the Polish DPA. Based on the facts of the case and on the analysis of the GDPR provisions, the UODO has stated that the company acts as a controller of complainant's personal d